Agents Break Together on Misuse, Apart on Injection

Abstract

Do safety breaches of computer-use agents co-occur across model families the way correctness errors do? Five agents from four vendors on 150 OS-Harm tasks, pre-registered, zero cost. On deliberate misuse the agents comply together (tetrachoric ρ 0.67, 1.4 effective votes of 5); on prompt injection which agent obeys is close to idiosyncratic (ρ 0.28, no task breaks all five); on the same tasks safety breaches are more shared than task failures (ρ 0.27–0.51).